I'd call this an exception. An organization that is willing to take one on the chin, so to speak, by declaring a breach of their policies even in the absence of evidence of abuse of the policy violation is actively demonstrating their commitment to security before they've been hacked.